I85PREP
⌘ K
TCO study materials
TCO study resources

TCO practice questions

One question at a time. Build your TCO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Tanium Platform Fundamentals

Which Tanium component is installed on each managed endpoint to gather data and execute actions?

  1. Tanium Gateway
  2. Tanium Zone Server
  3. Tanium Module Server
  4. Tanium Client Correct answer.

Explanation

The Tanium Client is the lightweight agent installed on every managed endpoint. It runs as a service, answers questions by running sensors, and executes deployed packages. Server-side components such as the Module Server and Zone Server support it but are not installed on endpoints.

Question 2Tanium Platform Fundamentals

What is the primary purpose of a Tanium Sensor?

  1. To install software on endpoints
  2. To schedule actions for later execution
  3. To read and return information from endpoints Correct answer.
  4. To store question results in the database

Explanation

Sensors are read-only scripts or commands that collect and return information from an endpoint. Because they do not change endpoint state, they are the building blocks of questions. Changing an endpoint requires a package and an action instead.

Question 3Tanium Platform Fundamentals

What does asking a Tanium Question accomplish?

  1. It runs sensors on endpoints and returns live data Correct answer.
  2. It deploys a package to a set of endpoints
  3. It upgrades the Tanium Client to the latest version
  4. It creates a new computer group automatically

Explanation

A question combines one or more sensors with a target, runs them on the selected endpoints, and returns results in near real time. It is a read-only operation and does not alter endpoint state. Actions, not questions, are used to make changes.

Question 4Tanium Platform Fundamentals

Which Tanium object contains the files and command line needed to perform a change on an endpoint?

  1. Sensor
  2. Computer group
  3. Saved question
  4. Package Correct answer.

Explanation

A package bundles the files and the command that an endpoint executes to make a change. Actions reference a package and determine which endpoints receive it. Sensors only read data, and they never carry executable content.

Question 5Tanium Platform Fundamentals

By default, which TCP port do Tanium Clients use to communicate with other clients and with the Tanium Server?

  1. 17472 Correct answer.
  2. 443
  3. 445
  4. 8080

Explanation

Tanium's default client communication port is TCP 17472. This port carries the peer-to-peer client traffic and the client connection to the Tanium Server or Zone Server. Port 443 is commonly used for HTTPS access to the console.

Question 6Tanium Platform Fundamentals

What is the role of the Tanium Module Server?

  1. It stores all endpoint data returned by questions
  2. It replaces the Tanium Client on servers
  3. It provides a peer-to-peer relay for endpoints in a DMZ
  4. It hosts modules such as Interact and Deploy Correct answer.

Explanation

The Module Server hosts Tanium solution modules that extend the core platform. The Tanium Server itself provides the core services, including client communication and question processing. Separating the roles keeps solution workloads off the core server.

Question 7Tanium Platform Fundamentals

What is a Tanium Computer Group used for?

  1. To define endpoint sets for targeting Correct answer.
  2. To group users by role for permission assignment
  3. To group packages by operating system
  4. To organize sensors into content sets

Explanation

Computer groups are collections of endpoints, and they provide the targeting used by questions and actions. Membership can be static or dynamic. User permissions and content visibility are handled by other objects.

Question 8Tanium Platform Fundamentals

How are members of a static computer group determined?

  1. By the operating system version reported by the client
  2. By the IP address range the endpoint belongs to
  3. By a filter that is evaluated each time the group is used
  4. By an administrator adding or removing endpoints manually Correct answer.

Explanation

A static computer group has an explicit membership list that an administrator curates. The list does not change automatically as endpoint data changes. Filter-based membership is the defining trait of a dynamic group.

Question 9Tanium Platform Fundamentals

Why does Tanium use a peer-to-peer linear chain for client communication?

  1. It allows clients to operate without any server component
  2. Clients relay data through neighbors to reduce server load Correct answer.
  3. It guarantees results are returned in under one second
  4. It encrypts all endpoint traffic with a shared symmetric key

Explanation

In the chain, clients pass communications through neighboring clients so the server does not need a direct session with every endpoint. This design scales efficiently to large endpoint counts. Encryption and timing guarantees are handled by other mechanisms.

Question 10Tanium Platform Fundamentals

What problem does a Tanium Zone Server solve?

  1. It hosts the Tanium Console web interface
  2. It relays client traffic from a segmented network to the server Correct answer.
  3. It provides additional storage for question results
  4. It balances sensor execution across module servers

Explanation

A Zone Server sits in a segmented or restricted network and relays client communications to the Tanium Server. Clients in that segment connect to the Zone Server rather than directly to the main server. This avoids opening inbound paths into the restricted segment.

Question 11Tanium Platform Fundamentals

How does a saved question differ from a question asked ad hoc in the console?

  1. A saved question cannot use sensors as filters
  2. A saved question runs only once and then is deleted
  3. A saved question can only target static computer groups
  4. It can be scheduled to run repeatedly and retain results Correct answer.

Explanation

A saved question stores the question definition so it can be run on a schedule. Because it runs regularly, its results build a history that can be reviewed and reported on. An ad hoc question returns results for that moment only.

Question 12Tanium Platform Fundamentals

What is the effect of requiring approval for actions?

  1. An approver must authorize the action before it deploys Correct answer.
  2. Actions are auto-approved when they target few endpoints
  3. Packages must be re-signed before every deployment
  4. Endpoints must acknowledge the action before it is queued

Explanation

When action approval is enabled, an action is held until a user with approval permission reviews it. Only after approval does the platform send the package to the targeted endpoints. This provides a control point for change management.

Question 13Tanium Platform Fundamentals

Which three components make up a Tanium persona?

  1. Computer group, package, and sensor
  2. Question, action, and saved question
  3. User group, role, and content set Correct answer.
  4. Zone server, module server, and gateway

Explanation

A persona combines a user group, a role, and a content set. The user group identifies who is affected, the role defines what they may do, and the content set defines which content they may use. Together these determine a user's effective access.

Question 14Tanium Platform Fundamentals

What does a Tanium role control?

  1. Which modules are installed on the Module Server
  2. Which sensors return results fastest
  3. Which endpoints a user can see in the console
  4. Which actions and features a user may perform Correct answer.

Explanation

A role is a collection of permissions that determines what a user is allowed to do, such as asking questions or deploying actions. Endpoint visibility is governed by computer group assignment, and content visibility is governed by content sets.

Question 15Tanium Platform Fundamentals

What makes a computer group dynamic?

  1. It is refreshed only when the Tanium Server restarts
  2. Its membership comes from a filter evaluated on endpoint data Correct answer.
  3. Its membership is imported from Active Directory on a schedule
  4. It contains endpoints that have not reported recently

Explanation

A dynamic computer group defines its membership with a filter rather than a fixed list. Endpoints join or leave the group automatically as their reported data matches or stops matching the filter. Static groups, by contrast, are maintained by hand.

Question 16Tanium Platform Fundamentals

Under which account does the Tanium Client service run on Windows endpoints by default?

  1. The Tanium Server service account
  2. The local SYSTEM account Correct answer.
  3. The logged-on interactive user
  4. A domain administrator account

Explanation

The Tanium Client runs as a Windows service under the local SYSTEM account. This gives it the local privileges needed to run sensors and packages whether or not a user is logged on. It does not use a domain administrator account by default.

Question 17Tanium Platform Fundamentals

When an action is deployed, what does the Tanium platform do?

  1. It asks sensors to report the installed software inventory
  2. It creates a saved question for the target group
  3. It delivers the package to targets and runs its command Correct answer.
  4. It registers new clients with the zone server

Explanation

An action sends the selected package to the endpoints in the target and instructs them to execute the package command. The action also controls the deployment schedule and targeting. Questions, not actions, gather read-only inventory data.

Question 18Tanium Platform Fundamentals

Which Tanium module is the primary interface for asking questions and viewing results?

  1. Patch
  2. Deploy
  3. Asset
  4. Interact Correct answer.

Explanation

Interact is the workspace where operators ask questions, review results, and drill into endpoint detail. The other modules build on that question-and-response foundation for their specific workflows. Deploy, Patch, and Asset each serve narrower purposes.

Question 19Tanium Platform Fundamentals

What is the purpose of Tanium Gateway?

  1. It provides a REST API for programmatic access Correct answer.
  2. It replaces the Module Server for small deployments
  3. It encrypts the peer-to-peer client chain
  4. It caches sensor results on endpoints

Explanation

Tanium Gateway exposes a REST API that lets external tools and scripts interact with the platform programmatically. It is an integration layer, not a replacement for any core infrastructure role. Encryption of client traffic is handled separately by transport security.

Question 20Tanium Platform Fundamentals

Why would an operator add a filter to a question?

  1. To convert the question into a saved action
  2. To reduce the number of sensors returned in each row
  3. To limit which endpoints are included by sensor values Correct answer.
  4. To force the question to run only on the Module Server

Explanation

A question filter restricts the endpoints that answer based on sensor values, such as only machines with a particular operating system. This narrows the result set to the population of interest. Filters do not change the sensors being collected or the question's type.

Question 21Tanium Platform Fundamentals

In a Tanium deployment with a Zone Server, which connection is initiated by the Zone Server?

  1. An outbound connection from the Zone Server to the Tanium Server Correct answer.
  2. An inbound connection from the Tanium Client into the Zone Server
  3. An inbound connection from the Module Server to each client
  4. An outbound connection from the Tanium Server to each client

Explanation

The Zone Server opens an outbound connection to the Tanium Server, which is why no inbound rules into the restricted segment are needed at the main server. Clients in the segment connect to the Zone Server instead of the main server. This arrangement keeps segmented networks reachable without exposing them.

Question 22Tanium Platform Fundamentals

How does a content set affect what an operator can do in the Tanium console?

  1. It controls the polling interval used by the Tanium Client
  2. It sets the maximum number of endpoints an action can target
  3. It determines which endpoints are online and able to answer questions
  4. It scopes which sensors and packages a persona can see and use Correct answer.

Explanation

Content sets partition platform content, such as sensors, packages, and saved questions, so that personas only see and use what is assigned to them. They work together with roles, which define permitted operations. Endpoint reachability and action size limits are not governed by content sets.

Question 23Tanium Platform Fundamentals

An operator asks a question, drills into results, and then deploys a package. What determines the endpoints that receive the package?

  1. The action group and any target filters on the action Correct answer.
  2. The sensors included in the original question
  3. The Tanium Client version reported in the question results
  4. The content set assigned to the package

Explanation

An action carries its own targeting through the action group and any additional filters applied at deployment time. Drilling into a question may inform the operator's choice, but it does not itself define the action target. The action's own target settings are authoritative.

Question 24Tanium Platform Fundamentals

Why do Tanium Clients generally not require inbound firewall ports to be opened on endpoints?

  1. Because clients open outbound connections to communicate Correct answer.
  2. Because sensors run only on the server
  3. Because the Tanium Server pushes configuration through DNS
  4. Because all client traffic uses UDP broadcast

Explanation

Clients establish outbound connections to their neighbors and to the server or Zone Server, so no inbound listener needs to be reachable from outside. This outbound-only pattern simplifies firewall configuration across large networks. Traffic is not broadcast-based, and configuration is not delivered through DNS.

Question 25Tanium Platform Fundamentals

Which statement best distinguishes the Tanium Server from the Tanium Module Server?

  1. The Tanium Server hosts modules, while the Module Server stores the client database
  2. The Server provides core services, while the Module Server hosts modules Correct answer.
  3. The Tanium Server uses port 443 for clients, while the Module Server uses 17472
  4. The Tanium Server runs only on Linux, while the Module Server runs only on Windows

Explanation

The Tanium Server delivers the core platform functions, including client communication and question processing. The Module Server is a separate host on which solution modules are installed and run. Keeping these roles separate lets modules be added or upgraded with less impact on core operations.

Question 26Tanium Platform Fundamentals

Which statement best describes a Tanium sensor?

  1. A named group of managed endpoints
  2. A read-only endpoint query definition Correct answer.
  3. A signed software installation bundle
  4. A network relay for client traffic

Explanation

A sensor is a read-only definition that, when evaluated by the Tanium Client, returns a specific piece of information about the endpoint. Sensors do not modify the endpoint; they only gather and report data. They are the building blocks of Tanium questions.

Question 27Tanium Platform Fundamentals

A Tanium package is best described as which of the following?

  1. Commands and files that change endpoints Correct answer.
  2. Permissions granted to a console operator
  3. Stored question results kept for reuse
  4. Records of client registration events

Explanation

A package bundles the command line and any supporting files needed to perform a change on an endpoint. Packages are executed through actions after an operator reviews question results. They are the mechanism by which Tanium makes modifications rather than only gathering data.

Question 28Tanium Platform Fundamentals

By default, which TCP port do Tanium Clients use to communicate with the Tanium Server?

  1. 17472 Correct answer.
  2. 1433
  3. 443
  4. 8443

Explanation

Tanium Clients initiate outbound communication to the Tanium Server over TCP port 17472 by default. This outbound-only pattern is why endpoints generally do not need inbound firewall rules. Port 443 is commonly used for HTTPS console or API access, and 1433 is the default SQL Server port.

Question 29Tanium Platform Fundamentals

Why does the Tanium Client keep a local cache of sensors and packages?

  1. To answer questions without re-downloading content Correct answer.
  2. To replace the server-side configuration database
  3. To encrypt traffic between endpoints and servers
  4. To store operator credentials for console access

Explanation

The Tanium Client caches sensor and package content locally so it can evaluate sensors and run actions without fetching the same content from the server each time. This reduces network load and speeds up question responses. The server database and encryption are separate concerns handled elsewhere in the platform.

Question 30Tanium Platform Fundamentals

Which data does the Tanium Server's database primarily hold?

  1. Live sensor code executed by each endpoint
  2. Configuration, question history, and action records Correct answer.
  3. The peer-to-peer chain map for each subnet
  4. Package binaries served directly to endpoints

Explanation

The database persists platform configuration, saved objects, question and action history, and related records. Sensor code and package files are distributed to clients through the platform's content mechanisms rather than being executed from the database. The peer-to-peer chain is computed dynamically by clients.

Question 31Tanium Platform Fundamentals

What is the main purpose of the Tanium API?

  1. To host the web-based management console
  2. To allow programmatic questions and actions Correct answer.
  3. To route client traffic between network zones
  4. To synchronize the server with domain controllers

Explanation

The Tanium API exposes platform capabilities so external tools and scripts can ask questions, retrieve data, and deploy actions programmatically. This supports automation and integration with other systems. Console hosting, directory synchronization, and traffic routing are handled by other components.

Question 32Tanium Platform Fundamentals

What is the purpose of a parameter in a Tanium sensor?

  1. It limits which endpoints receive the question
  2. It determines which operator may view results
  3. It provides input that changes sensor output Correct answer.
  4. It sets how often the client checks for updates

Explanation

A sensor parameter passes input to the sensor so the same sensor can return different information depending on the value supplied. For example, a parameter can specify a path or a registry key to inspect. Targeting is controlled by the question's computer group, and visibility is controlled by roles.

Question 33Tanium Platform Fundamentals

When a Tanium question returns results, what does one row typically represent?

  1. One sensor evaluated on all endpoints
  2. One endpoint's response to the question Correct answer.
  3. One operator who asked the question
  4. One package deployed by the question

Explanation

Question results are organized so that each row corresponds to an individual endpoint and its returned value for the sensor. This lets operators drill into results and target actions at specific machines. Questions themselves do not deploy packages; actions do that after results are reviewed.

Question 34Tanium Platform Fundamentals

What is the purpose of a Tanium user group?

  1. To bundle content for distribution
  2. To cluster servers for availability
  3. To group endpoints for question targeting
  4. To grant roles to multiple users Correct answer.

Explanation

A user group collects console users so that roles and permissions can be assigned to all of them at once. This simplifies administration when many operators need the same access. Grouping endpoints is done with computer groups, and bundling content is done with content sets.

Question 35Tanium Platform Fundamentals

What does a scheduled action allow an operator to do?

  1. Ask a question without saving results
  2. Deploy a package on a schedule Correct answer.
  3. Move endpoints between computer groups
  4. Automatically change an operator's role

Explanation

A scheduled action runs a package at a specified future time or on a repeating schedule. This is useful for maintenance tasks that must occur at defined intervals. Asking questions, changing roles, and moving endpoints are separate operations with their own controls.

Question 36Tanium Platform Fundamentals

What is the purpose of Tanium Airgap?

  1. To import content into offline environments Correct answer.
  2. To encrypt client traffic with TLS
  3. To archive question results for compliance
  4. To isolate a subnet behind a Zone Server

Explanation

Tanium Airgap provides a way to bring content into environments that have no internet access by transferring content packages into the deployment. This supports isolated or classified networks that cannot download updates directly. It does not provide network segmentation, encryption, or result archiving.

Question 37Tanium Platform Fundamentals

After a Tanium Client receives an action, what does it do?

  1. Stores the package in the database for later use
  2. Forwards the action to the Module Server for approval
  3. Rebroadcasts the action to every endpoint in the subnet
  4. Runs the package command line and reports the result Correct answer.

Explanation

When an action reaches an endpoint, the Tanium Client executes the package's command line and any associated files, then reports the outcome back through the platform. This allows operators to track action status per endpoint. Approval decisions are made before deployment, not by the client.

Question 38Tanium Platform Fundamentals

Where is a Tanium sensor actually evaluated when an operator asks a question?

  1. On the Module Server, inside the workbench service
  2. On the Tanium Server, using data uploaded by clients
  3. On the endpoint, by the local Tanium Client process Correct answer.
  4. In the database, through a stored procedure

Explanation

Sensors are evaluated locally by the Tanium Client running on each endpoint, and only the resulting values are returned to the server. This distributed execution model is what allows Tanium to query large populations quickly. The server aggregates and displays results but does not execute sensor code itself.

Question 39Tanium Platform Fundamentals

An operator asks a question targeting all computers. How are endpoints that are offline at the time handled?

  1. They return their last cached result immediately
  2. They are reported with a failure status by the server
  3. The question is queued and answers only after all respond
  4. They do not appear in results until they respond Correct answer.

Explanation

Question results are built from responses actually returned by endpoints, so a machine that is offline does not contribute a row until it reconnects and answers. The platform does not block the entire question waiting for every endpoint. This is why operators compare reported counts against the estimated total population.

Question 40Tanium Platform Fundamentals

If two operators ask an identical question at nearly the same time, how does Tanium handle it?

  1. The second question is rejected until the first finishes
  2. The second question becomes a saved question automatically
  3. Both questions run independently and double client load
  4. The second question reuses the first question's results Correct answer.

Explanation

Tanium recognizes identical question definitions and reuses results already gathered or in progress instead of issuing duplicate work to endpoints. This question caching prevents unnecessary load on clients and the network. The second operator still sees the results, but through the shared evaluation.

Question 41Asking Questions

Which characteristic distinguishes an open question from a closed question?

  1. It signals the answer the questioner expects to hear.
  2. It invites a descriptive answer rather than a yes or no. Correct answer.
  3. It is asked only after the interview has been summarized.
  4. It limits the respondent to selecting from prepared choices.

Explanation

Open questions use stems such as what, how, or tell me and let the respondent choose the content and length of the reply, so they cannot be satisfied with a bare yes or no. Closed questions restrict the answer to a short confirmation or a selection from fixed choices.

Question 42Asking Questions

A consultant needs the client to confirm one specific go-live date before writing the project plan. Which question best fits that need?

  1. What are your thoughts about when the system might possibly go live?
  2. How do you feel about the go-live date?
  3. Is the go-live date still 14 March? Correct answer.
  4. Tell me everything about how the launch has gone so far.

Explanation

A closed question is the right tool when a single unambiguous fact must be pinned down, because it forces the respondent to confirm or correct a specific proposition. Open questions are better for exploring context but leave the exact date unconfirmed.

Question 43Asking Questions

An interviewer wants to move from a broad topic to a precise fact using the funnel technique. Which sequence matches that technique?

  1. Closed question, then open question, then closed question.
  2. Specific fact, then broad topic, then summary.
  3. Rapid closed questions, then one open question.
  4. Broad open question, then narrowing, then specific closed. Correct answer.

Explanation

The funnel starts wide to let the respondent supply their own frame and context, then progressively narrows until a specific fact or commitment is confirmed. Reversing the order would impose the interviewer's frame before the respondent has spoken.

Question 44Asking Questions

Which question is a leading question?

  1. You were unhappy with the process, weren't you? Correct answer.
  2. Which of the three options did you choose?
  3. How would you describe the onboarding process?
  4. What happened when the reporting tool failed to load?

Explanation

A leading question embeds the questioner's position in the wording, so the respondent is nudged toward confirming it. The tag question here supplies the expected answer and leaves little room for a contrary view.

Question 45Asking Questions

An analyst asks: 'Is the new tool fast and easy to use?' Why is this a weak question?

  1. It bundles two separate issues into one answer. Correct answer.
  2. It asks the respondent to predict the future.
  3. It repeats a point the respondent already made.
  4. It is too open-ended to be analyzed.

Explanation

This is a double-barreled question: speed and ease of use are distinct attributes, and a single yes or no cannot tell the analyst which one is true. Splitting it into two questions produces interpretable data.

Question 46Asking Questions

A stakeholder becomes defensive when asked 'Why did you approve that design?' Which reframe is most likely to reduce the defensiveness while keeping the information goal?

  1. What factors led you to approve that design? Correct answer.
  2. Who else approved the design besides you?
  3. Why do you think the design was approved so quickly?
  4. Was the design approved without a proper review?

Explanation

Why questions can be heard as an invitation to justify oneself, which triggers defensiveness. Switching to a what question asks for the same causal information while framing it as a request for factors rather than a demand for excuses.

Question 47Asking Questions

The Five Whys technique is used in a root-cause interview primarily to do what?

  1. Rate the severity of a problem on a five-point scale.
  2. Confirm five separate facts with closed questions.
  3. Trace a chain of causes to the underlying source. Correct answer.
  4. Collect five independent opinions on the same problem.

Explanation

Each successive why follows the cause just given, so the line of questioning moves from the visible symptom toward the underlying source. The number five is a rule of thumb for depth, not a quota of opinions or facts.

Question 48Asking Questions

After asking a demanding open question, what should the interviewer do first?

  1. Offer a likely answer to help the respondent start.
  2. Move on if no answer arrives within two seconds.
  3. Restate the question in different words immediately.
  4. Stay silent and let the respondent think. Correct answer.

Explanation

A pause gives the respondent room to assemble a considered answer, and the silence usually produces richer content than a hurried prompt. Filling the gap too quickly takes the thinking back from the respondent.

Question 49Asking Questions

Why should an interviewer avoid asking several questions in one turn?

  1. Respondents usually answer only one of them. Correct answer.
  2. It prevents the use of closed questions later on.
  3. It makes the interview run beyond its scheduled time.
  4. It forces the respondent to take written notes.

Explanation

When questions are stacked, the respondent typically picks the easiest or last one to answer and the others drop away, so the interviewer loses information without noticing. Asking one question at a time keeps each answer attributable to a known prompt.

Question 50Asking Questions

A reflective question works by doing what?

  1. Summarizing the whole session in a single statement.
  2. Offering the interviewer's own opinion for reaction.
  3. Repeating a key word back to invite more detail. Correct answer.
  4. Asking the respondent to rank items in order.

Explanation

Reflecting a loaded word or phrase back to the respondent invites them to expand on it without the interviewer introducing new content. It is a minimal intervention that keeps the respondent talking.